ISO 31000 — Enterprise Risk Management (Awareness)

By the end

What you'll build

• Write a risk statement with a clear cause, event and consequence
• Analyse a risk in terms of likelihood and consequence and explain the reasoning
• Choose among avoid, reduce, share, retain and explain the trade-off
• Identify a risk owner and the specific action that changes the risk level
• Recognise common biases that distort risk estimates in group discussions
• Challenge a risk rating constructively using evidence rather than instinct

Curriculum

What's inside

6 modules · 35 lessons

1. 01

   Risk in plain terms

   6 lessons
   • Writing a risk statement with cause, event and consequence
   • Risk, issue, hazard and uncertainty distinguished
   • Upside risk and why opportunity belongs here
   • Principles that make risk management useful
   • Risk management as guidance, not a certifiable checklist
   • + 1 more lesson
2. 02

   Context and identification

   6 lessons
   • Establishing context before you start listing risks
   • Internal and external context in practice
   • Techniques for identifying risks in a workshop
   • Emerging risk and weak signals
   • Avoiding a register full of the same risk five times
   • + 1 more lesson
3. 03

   Analysis and evaluation

   6 lessons
   • Rating likelihood and consequence without pretending to precision
   • Qualitative and quantitative approaches
   • Risk criteria, matrices and their weaknesses
   • Cognitive biases in group risk estimates
   • Aggregating risk across a portfolio
   • + 1 more lesson
4. 04

   Treatment and ownership

   6 lessons
   • Choosing a treatment that actually changes the risk
   • Avoid, reduce, share, retain: real trade-offs
   • Controls and their assumed effectiveness
   • Assigning ownership that carries authority
   • Residual risk and formal acceptance
   • + 1 more lesson
5. 05

   Monitoring and communication

   6 lessons
   • Keeping a risk register alive instead of archived
   • Indicators that give early warning
   • Reporting risk to leadership without alarmism
   • Reviewing risks after an incident or a change
   • Embedding risk thinking into everyday decisions
   • + 1 more lesson
6. 06

   Practice and check

   5 lessons
   • Risk vocabulary that gets mixed upmatch pairs
   • Getting a new risk onto the register properlysequence order
   • Say it the way the standard says itfill blank
   • The workshop that wants to write cyber risk highscenario
   • Course quizquiz

The shape of it

How this course works